{"id":4904,"date":"2023-12-05T21:16:20","date_gmt":"2023-12-05T21:16:20","guid":{"rendered":"https:\/\/osintme.com\/?p=4904"},"modified":"2023-12-19T17:21:45","modified_gmt":"2023-12-19T17:21:45","slug":"threat-actor-from-a-russian-operated-crime-forum-targeting-users-in-ireland","status":"publish","type":"post","link":"https:\/\/osintme.com\/index.php\/2023\/12\/05\/threat-actor-from-a-russian-operated-crime-forum-targeting-users-in-ireland\/","title":{"rendered":"Threat actor from a Russian operated crime forum targeting users in Ireland"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"osint\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

A file containing breached or leaked data of over 28.000 people living in Ireland has recently surfaced on one of the clearnet data leaks forums. Now, as far as breach records go, this one is a very structured and clean Excel file containing email addresses, names, surnames, general locations and phone numbers. Usually data dump files are bulky and messy, which is not the case here. But, first things first.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This research was initiated after an anonymous tip off from a reader. A big thank you is owed to the person who flagged this to me – and a big thank you is hereby expressed.<\/p>

The dump file was originally posted on Saturday, 2nd of December at 2:39PM.<\/p>

I apologise for the redacted screenshot content, but I don’t want to further victimise the people whose details are in the leak by showing too much information that would lead to their identification.<\/p>

NB:<\/strong> If you have a genuine, legitimate interest in this (government employee, press or cybersecurity researcher, etc.), you can contact me about it on the email address provided at the end of this post.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"osint\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The dump file is hosted externally from the crime forum. At the time of this research, and according to the external website’s content download counter, it was downloaded only 12 times.<\/p>

The file does not contain any credit card details or any other information that could be easily monetised by cyber criminals. The fact that it’s being shared for free suggests its perceived low value, but naturally the personal information within can be used to conduct random phishing, spam and automated voicemail scam attacks, as well as more targeted attempts against profiled targets.<\/p>

The origin of the data dump file is unclear and while the metadata analysis offers some insights, they cannot be taken for granted as metadata – as we all know – is easily manipulated.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
file_name<\/strong><\/em><\/div>
\u00a0********.xlsx [REDACTED]
<\/em><\/div><\/div><\/div>
file_size<\/strong><\/em><\/div>
\u00a01659 kB<\/em><\/div><\/div><\/div>
file_type<\/strong><\/em><\/div>
\u00a0XLSX<\/em><\/div><\/div><\/div>
file_type_extension<\/strong><\/em><\/div>
\u00a0xlsx<\/em><\/div><\/div><\/div>
mime_type<\/strong><\/em><\/div>
\u00a0application\/vnd.openxmlformats-officedocument.spreadsheetml.sheet<\/em><\/div><\/div><\/div>
zip_required_version<\/strong><\/em><\/div>
\u00a020<\/em><\/div><\/div><\/div>
zip_bit_flag<\/strong><\/em><\/div>
\u00a00x0006<\/em><\/div><\/div><\/div>
zip_compression<\/strong><\/em><\/div>
\u00a0Deflated<\/em><\/div><\/div><\/div>
zip_modify_date<\/strong><\/em><\/div>
\u00a01980:01:01 00:00:00<\/em><\/div><\/div><\/div>
zip_crc<\/strong><\/em><\/div>
\u00a00xa458f7aa<\/em><\/div><\/div><\/div>
zip_compressed_size<\/strong><\/em><\/div>
\u00a0378<\/em><\/div><\/div><\/div>
zip_uncompressed_size<\/strong><\/em><\/div>
\u00a01556<\/em><\/div><\/div><\/div>
zip_file_name<\/strong><\/em><\/div>
\u00a0[Content_Types].xml<\/em><\/div><\/div><\/div>
application<\/strong><\/em><\/div>
\u00a0Microsoft Excel<\/em><\/div><\/div><\/div>
doc_security<\/strong><\/em><\/div>
\u00a0None<\/em><\/div><\/div><\/div>
scale_crop<\/strong><\/em><\/div>
\u00a0No<\/em><\/div><\/div><\/div>
\u00a0<\/div>
links_up_to_date<\/strong><\/em><\/div>
\u00a0No<\/em><\/div><\/div><\/div>
shared_doc<\/strong><\/em><\/div>
\u00a0No<\/em><\/div><\/div><\/div>
hyperlinks_changed<\/strong><\/em><\/div>
\u00a0No<\/em><\/div><\/div><\/div>
app_version<\/strong><\/em><\/div>
\u00a014.03<\/em><\/div><\/div><\/div>
creator<\/strong><\/em><\/div>
\u00a0Acer<\/em><\/div><\/div><\/div>
last_modified_by<\/strong><\/em><\/div>
\u00a0Acer<\/em><\/div><\/div><\/div>
create_date<\/strong><\/em><\/div>
\u00a02022:06:29 16:21:11Z<\/em><\/div><\/div><\/div>
modify_date<\/strong><\/em><\/div>
\u00a02022:06:29 16:27:23Z<\/em><\/div><\/div><\/div>
category<\/strong><\/em><\/div>
\u00a0application<\/em><\/div><\/div><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The creation and modification date above can indicate that this is not a new file and that it has been around for the last year or so. Then again, those values could have been manipulated.<\/p>

The name in the creator field, “Acer”, might suggest that the origin of this data could be the massive 2021 data breach from Acer<\/a> – or maybe not.<\/p>

I took a sample of 10 email addresses from the file and checked them against the Acer dump records – there were no matches found.<\/p>

The motivations of the threat actor who is posting a cleaned up, fraud-ready file for free that contains details of only Irish residents are unclear, but sure as hell they are not friendly.<\/p>

After initially thinking he could be posting in order to gain notoriety and cybercrime “street cred”, I researched the user’s activities on the forum in question as well as other forums. He is by far the most active user on that particular forum, based on their own forum credits count:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"osint\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Note that I use “he”<\/strong> deliberately – threat actors should remember that data breaches are a double edged sword and their own leaked credentials from the past can be used against them in the same way they use them against their victims (minus the scam \/ financial fraud aspects).<\/p>

It’s worth noting that the forum where this and other similar content is being posted is registered anonymously and operated from a hosting IP address in the Netherlands by a company based in Macao. However, even a cursory examination of the site reveals that the forum is operated by russian speakers, based on the following facts:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"osint\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t